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~ The MAILING DATE of this communication appears on the cover sheet with the correspondence address- 

All claims being allowable, PROSECUTION ON THE MERITS IS (OR REMAINS) CLOSED in this application. If not included 
herewith (or previously mailed), a Notice of Allowance (PTOL-85) or other appropriate communication will be mailed in due course. THIS 
NOTICE OF ALLOWABILITY IS NOT A GRANT OF PATENT RIGHTS. This application is subject to withdrawal from issue at the initiative 
of the Office or upon petition by the applicant. See 37 CFR 1.313 and MPEP 1308. 

1 . |EI This communication is responsive to Telephone interview with Alan Minsk 12/30/2008. 

2. The allowed claim(s) is/are 1,2,5-10 and 12-19 . 

3. □ Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 

a) □ All b)DSome* c) □ None of the: 

1. □ Certified copies of the priority documents have been received. 

2. □ Certified copies of the priority documents have been received in Application No. . 

3. □ Copies of the certified copies of the priority documents have been received in this national stage application from the 

International Bureau (PCT Rule 17.2(a)). 
* Certified copies not received: . 

Applicant has THREE MONTHS FROM THE "MAILING DATE" of this communication to file a reply complying with the requirements 
noted below. Failure to timely comply will result in ABANDONMENT of this application. 
THIS THREE-MONTH PERIOD IS NOT EXTENDABLE. 

4. □ A SUBSTITUTE OATH OR DECLARATION must be submitted. Note the attached EXAMINER'S AMENDMENT or NOTICE OF 

INFORMAL PATENT APPLICATION (PTO-152) which gives reason(s) why the oath or declaration is deficient. 

5. □ CORRECTED DRAWINGS ( as "replacement sheets") must be submitted. 

(a) □ including changes required by the Notice of Draftsperson's Patent Drawing Review ( PTO-948) attached 

1 ) □ hereto or 2) □ to Paper No./Mail Date . 

(b) □ including changes required by the attached Examiner's Amendment / Comment or in the Office action of 

Paper No./Mail Date . 

Identifying indicia such as the application number (see 37 CFR 1. 84(c)) should be written on the drawings in the front (not the back) of 
each sheet. Replacement sheet(s) should be labeled as such in the header according to 37 CFR 1.121(d). 

6. □ DEPOSIT OF and/or INFORMATION about the deposit of BIOLOGICAL MATERIAL must be submitted. Note the 

attached Examiner's comment regarding REQUIREMENT FOR THE DEPOSIT OF BIOLOGICAL MATERIAL. 
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EXAMINER'S AMENDMENT 

An examiner's amendment to the record appears below. Should the changes and/or additions 
be unacceptable to applicant, an amendment may be filed as provided by 37 CFR 1.312. To 
ensure consideration of such an amendment, it MUST be submitted no later than the payment 
of the issue fee. 

Authorization for this examiner's amendment was given in a telephone interview and 
email with Alan Minsk (Reg # 35956) on 12/30/2008. 
The application has been amended as follows: 

In the claims: 
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1. (Currently Amended) A method for detecting a spoofed network connection comprising: 

receiving a connection from a client; 

delaying sending a greeting message for a delay period, the delay period being less than 
or equal to a maximum tolerable delay, the maximum tolerable delay being the longest delay that 
would be tolerated by a valid client; 

monitoring the connection during the delay period; 

if a command is received from the client before the greeting is sent, then identifying the 
connection as the spoofed connection; 

processing any electronic mail associated with the spoofed connection; 
wherein a spoofed connection electronic-mail message is processed using a process 
selected from the group consisting of: 

deleting the spoofed-conncction electronic-mail message; 

marking the spoofcd-conncction electronic-mail message; and 

storing the spoofed-conncction electronic-mail message in an electronic directory . 

2. (Original) The method of claim 1 further comprising: 

sending the greeting to the client upon completion of the delay period. 

3. (Cancelled). 

4. (Cancelled). 

5. (Original) The method of claim 1 wherein the connection is a Transmission Control Protocol 
(TCP) connection. 

6. (Original) The method of claim 1 wherein the client is a Mail Transfer Agent (MTA) or Mail 
User Agent (MUA). 
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7. (Original) The method of claim 1 wherein the received command is a Simple Mail Transfer 
Protocol (SMTP) command. 

8. (Currently Amended) A method for detecting a spoofed network connection comprising: 

receiving a first command at a server from a client; 

delaying, for a delay period, a transmission of a reply associated with the first command, 
the delay period being less than or equal to a maximum tolerable delay, the maximum tolerable 
delay being the longest delay that would be tolerated by a valid client; 

monitoring a connection between the server and the client during the delay period; 
if a second command is received at the server before the reply is transmitted, then 
identifying the connection as the spoofed connection; 

processing any electronic mail associated with the spoofed connection; 
wherein a spoofed connection electronic-mail message is processed using a process 
selected from the group consisting of: 

deleting the spoofcd-conncction electronic-mail message; 

marking the spoofed-conncction electronic-mail message; and 

storing the spoofed-connection electronic-mail message in an electronic directory . 

9. (Original) The method of claim 8 further comprising: 

sending a greeting to the client when the connection is established with the server. 

10. (Original) The method of claim 8 further comprising: 

transmitting the reply upon completion of the delay period. 

11. (Cancelled) 

12. (Original) The method of claim 8 wherein the connection is a Transmission Control Protocol 
(TCP) connection. 
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13. (Original) The method of claim 8 wherein the client is a Mail Transfer Agent (MTA) or Mail 
User Agent (MUA). 

14. (Original) The method of claim 8 wherein the received command is a Simple Mail Transfer 
Protocol (SMTP) command. 

15. (Currently Amended) An apparatus for detecting a spoofed connection comprising: 

means for detecting when a connection is established between the apparatus and a 
client device; 

means for transmitting a greeting message or a reply or both to the client device; 

means for delaying the transmitting means so that the greeting message or the reply or 
both are not transmitted during a delay period, the delay period being less than or equal to a 
maximum tolerable delay, the maximum tolerable delay being the longest delay that would be 
tolerated by a valid client; and 

means for monitoring the connection to detect commands that are sent by the client 
device at least during the delay period^ 

if a command is received from the client before the greeting message or a reply or both is 
sent, then identifying the connection as the spoofed connection; 

means for processing any electronic mail associated with the spoofed connection; 

wherein a spoofed connection electronic-mail message is processed using a process 
selected from the group consisting of: 

deleting the spoofed-connection electronic-mail message; 

marking the spoofed-connection electronic-mail message; and 

storing the spoofed-connection electronic-mail message in an electronic directory . 

16. (Original) The apparatus of claim 15 wherein the client device is a Mail Transfer Agent 
(MTA) or Mail User Agent (MUA). 

17. (Original) The apparatus of claim 15 wherein the detecting means, the transmitting means, 
the delaying means, and the monitoring means comprise one or more processor-based devices 
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running software algorithms to provide the detecting, transmitting, delaying and monitoring 
functions. 

18. (Original) The apparatus of claim 15 wherein the connection is a Transmission Control 
Protocol (TCP) connection. 

19. (Original) The apparatus of claim 15 wherein the commands are Simple Mail Transfer 
Protocol (SMTP) commands. 
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REASONS FOR ALLOWANCE 

The following is the examiner's statement of reasons for allowance: 

Independent claims 1,8, and 15 among other things teach 

The main reason for allowance in conjunction with all the other claim limitations is a 
method for detecting a spoofed network connection comprising receiving a connection from a 
client and delaying sending a greeting message for a delay period, the delay period being less 
than or equal to a maximum tolerable delay, the maximum tolerable delay being the longest 
delay that would be tolerated by a valid client. The connection is monitored during the delay 
period and if a command is received from the client before the greeting is sent, then identifying 
the connection as the spoofed connection. Furthermore any electronic mail associated with the 
spoofed connection is processed utilizing a process of deleting the spoofed-connection 
electronic-mail message, marking the spoofed-connection electronic-mail message, or storing the 
spoofed-connection electronic-mail message in an electronic directory. 

Any comments considered necessary by applicant must be submitted no later than the 
payment of the issue fee and, to avoid processing delays, should preferably accompany the issue 
fee. Such submissions should be clearly labeled "Comments on Statement of Reasons for 
Allowance." 



CORRESPONDANCE INFORMATION 
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Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to FARHAD ALI whose telephone number is (571)270-1920. The 
examiner can normally be reached on Monday thru Friday, 7:30am to 5:00pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Jeffrey C. Pwu can be reached on (571) 272-6798. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 
like assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



/Farhad AhV 
Examiner, Art Unit 2446 

/Jeffrey Pwu/ 

Supervisory Patent Examiner, Art Unit 2446 



